隨著互聯(lián)功能的不斷普及，汽車遭受網(wǎng)絡(luò)攻擊的風(fēng)險也與日俱增。車輛在道路中的行駛時間越長，訪問入口暴露出來的幾率就越高。因此，整個汽車行業(yè)都加入了一場狂熱的競賽，各大公司都爭先恐后地尋找各種網(wǎng)絡(luò)防御措施，從而在各個層面實現(xiàn)安全可靠、實時監(jiān)控的網(wǎng)絡(luò)保護機制。在SAE 2016全球汽車年會上，一位來自英特爾公司(Intel)的技術(shù)專家，分享了對于“汽車行業(yè)該如何確保網(wǎng)聯(lián)安全”這一問題的看法。
英特爾的物聯(lián)網(wǎng)(IoT)安全部門總經(jīng)理Lorie Wigle認為，雖然加密技術(shù)（特別是針對CAN總線的加密）一直受到大力吹捧，但“現(xiàn)實是，加密僅能解決部分網(wǎng)絡(luò)威脅。”
Wigle表示，要解決汽車網(wǎng)絡(luò)安全的問題，并不存在什么 “靈丹妙藥”。安全防御應(yīng)當是一系列持續(xù)性的行為，并沒有一勞永逸的解決方案，安全防御的范圍也不局限于車輛的本身。
云平臺——面對威脅最大
“如何保證云平臺和基礎(chǔ)設(shè)施的安全是重中之重，”Wigle解釋說，對于高威脅性的網(wǎng)絡(luò)攻擊者而言，“最簡單的作法是直接攻擊云端，而非汽車本身。”
Wigle表示，盡管許多人普遍認為當然的威脅風(fēng)險很高，但事實上就汽車本身的系統(tǒng)復(fù)雜程度而言，仍屬于相對較低的水平，雖然每輛車大約會搭載25到200個微處理器，運行多達6500萬行代碼，但其中50%均為多媒體系統(tǒng)所用。目前，一款豪華車型擁有144個電子控制單元(ECU)，其中73個位于CAN總線、61個位于LIN網(wǎng)絡(luò)，其余10個位于Flexray系統(tǒng)中。此外，對于一輛頂配的汽車而言，車內(nèi)為了實現(xiàn)內(nèi)部控制可能會安裝高達100個電機。
云平臺或許是最佳的攻擊目標，但汽車本身也有可能是很多黑客下手的對象。Wigle介紹了6種主要威脅：首先，最常見的一種是盜車賊，他們可以借助物理方法，或通過無線網(wǎng)絡(luò)打開車門。接下來的一種更具技術(shù)含量，也就是那些渴望“一戰(zhàn)成名”的黑客，他們完全是通過無線網(wǎng)絡(luò)途徑對目標進行攻擊的。
然而，最具威脅性的一類罪犯，擁有相對較高的技術(shù)基礎(chǔ)，能夠?qū)o線網(wǎng)絡(luò)與物理訪問相結(jié)合，甚至危害車內(nèi)乘客的安全。此外，現(xiàn)在還存在擁有完全物理訪問權(quán)限的調(diào)節(jié)器，可以直接修改車輛的控制設(shè)置。在很大程度上，上述最高威脅級別的黑客很可能就來自公司的競爭對手及偽造者，他們有能力獲得完整的物理訪問權(quán)限，并希望了解車輛的內(nèi)部架構(gòu)。
Wigle表示，雖然車輛的通信功能目前仍主要集中在信息娛樂系統(tǒng)之內(nèi)，但未來卻要面對一個全面互聯(lián)的環(huán)境，包括V2V、V2I和V2X連接，即車間通信、車輛與基礎(chǔ)設(shè)施通信，以及對車載驅(qū)動/制動系統(tǒng)的實時整合。就現(xiàn)階段而言，汽車自動駕駛功能僅在極少數(shù)幾款車型上配置，大多仍以適應(yīng)性巡航控制和相關(guān)半自動系統(tǒng)的形式出現(xiàn)。
目前，車輛的車載數(shù)據(jù)分析主要集中在車輛性能及汽車位置等導(dǎo)航相關(guān)信息，但未來車輛與駕駛員的個人數(shù)據(jù)也將會被納入其中。
Bumper-to--bumper防御
Wigle表示，“Bumper to Bumper”這個術(shù)語通常僅用于描述車輛的保修情況，但最近也用于描述車輛周邊以及云端的適應(yīng)性安全防護范圍。行業(yè)最佳作法要求廠商在可能的情況下，盡量將“受攻擊面”移到云端。Wigle稱，英特爾下屬麥克菲McAfee公司所開的IPS(入侵防御系統(tǒng))就是一個這樣的例子。
不過，英特爾還在同時推廣公司的汽車增強通信單元，其中包括一個“硬件安全防御模塊”，旨在提供全面的運行與安全硬件防御。該系統(tǒng)內(nèi)置了風(fēng)河公司(Wind River)的管理程序，可以在一款獨立中央處理器上運行多操作系統(tǒng)，以及英特爾的計算機版“Trusted Execution Engine（可信執(zhí)行引擎）”。這種硬件技術(shù)經(jīng)過專門設(shè)計，可以驗證平臺及其操作系統(tǒng)的真實性，并授予不同級別的信任等級，從而提供安全防護。
Wigle表示，未來OTA（空中）軟件升級并不會出現(xiàn)在兩個獨立設(shè)備之間，而是通過在兩個授信的團體之間進行。
她指出，汽車電子系統(tǒng)的安全防護有兩個方面。首先，正如 SAE J3061指南描述的那樣，這種防護可以提供更加安全、靈活的開發(fā)流程。具體來說，這種做法需要首先識別所有的受攻擊面，并為其編號，然后進行威脅分析，從而進一步減少攻擊面的數(shù)量并加固軟硬件系統(tǒng)。此外，SAE J3101標準也介紹了一系列僅通過軟件功能無法實現(xiàn)的硬件保護措施。
Wigle同時指出，英特爾還集合了來自汽車行業(yè)供應(yīng)商的研發(fā)人員，成立了汽車安全審查委員會（Automotive Security Review Board，簡稱ASRB），從而共同開發(fā)基于英特爾平臺的解決方案。目前，ASRB還聯(lián)合“白帽”安全研究組織IOActive、iamthecavalry.org和opengarages.org，共同招募網(wǎng)絡(luò)安全專家，為汽車網(wǎng)絡(luò)安全做出貢獻。
作者：Paul Weissler
來源：SAE《汽車工程》雜志
翻譯：SAE中國辦公室
Intel's "bumper-to-bumper" vehicle security approach
As vehicle connectivity becomes ubiquitous, the threat of being hacked rises. The longer a car is on the road, the more its access points become exposed. Thus the industry's feverish race to find a robust and ongoing cyber defense at every level. At the 2016 SAE World Congress, an expert at microprocessor supplier Intel gave her assessment of what the industry must do to ensure that defense.
According to Lorie Wigle, General Manager of Intel's Internet of Things (IoT) Security, while encryption (particularly of the CAN bus) has been highly-touted, "the reality is encryption is going to address just part of the threat."
There is no "silver bullet" solution, Wigle said. Security must be a continuing operation, not a single preparatory event. And it extends beyond the vehicle.
Biggest bang in cloud
"Clouds and infrastructure also must be secured," she explained, noting that the "biggest bang for the buck" for a high-threat attacker is in "the cloud," not the car parc.
Although many consider today's threat level high, the automotive fleet actually represents relatively low complexity, despite the fact that a typical car has 25 to 200 microprocessors and up to 65 million lines of codes, about half of which are for the multimedia systems, she said. A current luxury model has 144 ECU connections—73 are on CAN busses, 61 are on LIN (Local Interconnect Networks) and 10 on FlexRay. Further, a fully-optioned vehicle may have up to 100 electric motors for interior controls.
The cloud may be the highest value target, but the vehicle itself is the object of many groups of potential attackers. Wigle pointed out six primary threat models. The most common is the car thief, whose access into the vehicle is typically physical entry but also via wireless. More technically astute is the hacker seeking his minutes of fame and working the purely wireless approach.
The highest threats, however, come from the criminal who may have medium to very high technical knowledge and can combine wireless with physical access to pose a danger to passengers. There's also the workshop tuner with total physical access to modify a vehicle's control settings. Perhaps the highest hacker-threat comes from counterfeiters and competitors, who have physical access and are looking to understand the vehicle architecture.
According to Wigle, the present level of telematics is largely in the entertainment area, whereas the future is a fully connected environment—V2V, V2I and V2X (vehicle to vehicle and infrastructure, and real-time integration with on-board drive/brake systems). Vehicle automated operation is on a handful of cars, and limited in most cases to advanced forms of adaptive cruise and related semi-autonomous systems.
Data analytics on-board is currently focused on performance and such navigation-related items as vehicle location, whereas the future will go well beyond, into vehicle-driver personal data.
Bumper-to-bumper defense
The term "bumper to bumper" used to only describe a vehicle's warranty. Recently it has also come to describe the adaptive security perimeter around the vehicle and extending into the cloud, Wigle said. Best practices will require moving "attack surfaces" to the cloud where possible. She pointed to Intel McAfee's cloud-based IPS (Intrusion Prevention System) as an example.
However, Intel also is promoting its vehicle enhanced head unit including a "Hardware Security Module" intended to provide broad-based operating and security hardware coverage. The system includes a Wind River hypervisor, which can run multiple operating systems on a single central processing unit, and Intel's PC-established "Trusted Execution Engine." This hardware technology is designed to attest to the authenticity of a platform and its operating system and establish levels of trust to provide security.
OTA (over the air) software updates, Wigle said, will not be between individual devices, but from and to certified groups.
There are two sides of providing vehicle electrical system security, she noted. One is a secure, flexible development process as described in the guidebook for SAE J3061. This requires identifying and numbering all attack surfaces and conducting threat analyses, reducing attack surfaces and hardening the hardware and software. It is accompanied by SAE J3101, which defines a common set of requirements for hardware protection which exceeds the capability of the software alone.
Wigle also pointed to Intel's formation of the Automotive Security Review Board, to be composed of researchers from industry vendors, to develop solutions using Intel-based platforms. ASRB is working with three "white hat" security research operations—IOActive, iamthecavalry.org and opengarages.org—to recruit cybersecurity professionals to contribute.
Author: Paul Weissler
Source: SAE Automotive Engineering Magazine
英特爾眼中的“bumper-to-bumper”安全范圍包括上圖所列的所有內(nèi)容，另外還包括基于云技術(shù)的交通監(jiān)控和虛擬補丁(virtual patching)功能。據(jù)了解，虛擬補丁是一種防止新發(fā)現(xiàn)漏洞被黑客利用的暫行辦法，可以在獲得更持久的修復(fù)措施之前暫時使用。